Magazine menu Close Magazine menu

IT Infrastructure

Latest stories

Person wearing augmented reality (AR) glasses reaches out and touches a virtual version of themselves.

Does virtual and augmented reality mean augmented cybercrime too?

  • min read
    • Not so long ago, augmented reality (AR) and virtual reality (VR) were the stuff of science fiction. Now they've become more than just niche experimental technologies. They're rapidly entering the mainstream, particularly in the consumer world of interactive media. But it's not just things like video games that are being transformed by the rise of VR platforms – there are some promising business cases for AR and VR too. In fact, some experts estimate that they will become indispensable technologies in the business world by as early as 2025. What is augmented and virtual reality? Although augmented and virtual reality are closely related, they're not the same thing. AR 'augments' the real world around the user by adding digital elements to the real-world view. Perhaps the most familiar example is the mobile game Pokémon Go, as well as less successful products like the infamous Google Glass. VR, by contrast, provides a far more immersive experience, since it relies on shutting out the physical world entirely. Popular VR devices include gaming platforms like HTC Vive and Oculus Rift, as well as lower-tech and more affordable experiences like those offered by Google Cardboard. Another term you'll encounter is mixed reality (MR), which refers to experiences that combine elements of both VR and AR. One of the best-known examples is Microsoft HoloLens, an MR platform designed specifically for business applications. What are the business applications of augmented and virtual reality? Rapid prototyping One of the most promising applications is product prototyping, a process which involves creating a complete digital model of a product (or, a so-called digital twin) and merging it with a VR experience. This allows for extensive testing and ideation without the high costs of developing multiple physical prototypes. Employee training Another popular business application, and one that's already entering mainstream use, is employee training. By applying VR or AR to training programs, it's possible to build a safe and highly interactive simulated environment with real-time feedback. Similarly, AR and VR can help improve workplace safety, especially in hazardous environments, be they workshop floors or nuclear reactors. AR can also help workers assemble, operate and maintain complex machines by providing real-time information overlaid onto their headsets. These are just a few of the exciting applications of augmented and virtual reality. And, though they might still sound like science fiction to the layperson, they're actually not. Companies like Ford, Airbus and Sotheby's are already using them. The wearable camera problem Augmented reality headsets depend on their abilities to understand the local environment, which means cameras are often essential components and they can pose a security risk. Ever since the first Google Glass prototype was released to much fanfare back in 2013 (only to fail miserably by 2015), there have been growing concerns around privacy and security. The launch of Google Glass even gave rise to the colorful term 'glasshole', which refers to those people who behaved inappropriately while using the device (such as by spying on others and taking photos without their knowledge). But edgy names aside, this has serious implications in fields such as healthcare where organizations are subject to strict compliance regulations like HIPAA to protect patient privacy. A new frontier for social engineering Aside from privacy concerns, AR and VR devices are connected like any other. They're part of a rapidly growing global network that's often dubbed the Internet of Things (IoT). And, like any connected device, they handle the transmission and storage of data, which might be misappropriated by hackers. When it comes to the immersive experiences of AR and VR, this has especially worrying potential in corporate espionage and social engineering. When technology can reach the point of convincing the brain it's somewhere where it's not, the opportunities for taking advantage of human vulnerabilities are enormous. As with any technology, the weakest link is normally the users themselves, which makes AR and VR a unique target for exploiting people. For example, attackers might inject features into VR platforms designed to mislead users into giving away personal information. There are also new implications for ransomware, in which attackers could sabotage platforms and interrupt important meetings before asking for a ransom. VR and AR experiences are only going to get more immersive and more realistic. On the one hand, this might make them more engaging and widely used. On the other, it makes them more dangerous. Fake identities, or so-called 'deepfakes' generated by machine-learning technologies, for example, allow for the manipulation of voices and videos to the extent they still look like genuine footage. If a hacker could access the motion-tracking data from a VR headset, they could potentially use it to create a digital replica. They could then superimpose this on someone else's VR experience, such as an immersive business conference, to carry out a social engineering attack. With people interacting more and more through avatars, this brings an entirely new dimension to the disturbing world of cybercrime. Data breach risks Aside from potentially providing cybercriminals with new ways to manipulate their victims, VR and AR present all the classic cybersecurity risks too. As systems that transmit and store data, they're fair game for anyone wanting to get their hands on the most valuable commodity in the world: personal data. They're also possible targets for denial of service attacks (DDos), which could have very serious implications for those depending on AR in critical situations such as surgical procedures or when operating dangerous machinery. Mitigating the risks isn't as hard as you think To address the risks associated with AR and VR, it's best to start with the core principles of information security – the very same ones that should be governing the wider IT infrastructure across the organization. Although attacks against AR and VR systems manifest themselves in different ways, the technological and administrative measures used to safeguard them are similar to other forms of connected technology. They use the same protocols as any other connected device, so all the standard rules apply – include them in your risk assessments, keep firmware up to date and encrypt any sensitive data. And never take security for granted. Most AR and VR devices don't encrypt data by default, and they may integrate with third-party apps which themselves have dubious security. On top of all the standard measures, AR and VR present some unique challenges, particularly when it comes to physical security and safety. One of the biggest problems with VR specifically is that it completely blocks off a user's visual and auditory connection to the outside world. It's always important to evaluate the physical safety and security of the user's environment first. This also applies to AR, in which it's important for users to maintain a high degree of situational awareness, particularly in more immersive environments. And, it should go without saying, but don't run around in a busy workspace wearing a VR headset! Although identity and access management are central to any information security strategy and concern any device, this is an area that's often overlooked when it comes to the adoption of AR and VR systems. You might, for example, be able to identify other people you're working with by their avatars, but there's also the potential risk of the avatar being copied and used by an unauthorized party. Fortunately, used in the right way, AR and VR can potentially improve identity and access management with multifactor authentication (MFA) – for example using eye-tracking sensors to verify your identity before you can access the rest of the system. While the challenges are undeniable, so is the potential of adopting augmented and virtual reality into the workplace.
threats outer space

How criminals could use space junk to attack any business

  • min read
    • A powerful way cybercriminals can cause catastrophic damage on Earth is to attack in space. It may sound like science fiction, but now we all rely on space infrastructure to do business, any organization could be affected. Space enthusiast and Distinguished Chair of the cybersecurity program at Middle East Institute Chris Kubecka explains a little-known space disaster scenario we should be more aware of in Tomorrow Unlocked's video Threats in Outer Space. Smash-ups in space Although space exploration has brought many world-changing advances, it's left orbit like many places on Earth – littered. From obsolete satellites to rocket parts and chips of paint, space junk circles the Earth at high speeds, threatening to collide with useful things, like working satellites and the International Space Station. Collisions could be deadly or cause irreparable damage to expensive equipment. Any smash-up creates more space junk, raising the risk to other orbiting objects. For a sense of just how much 'stuff' there is up there, see known space objects tracked in real-time on StuffIn.Space, some known only as 'debris' or 'unknown.' The 'black swan' of space crashes One of the most serious consequences of a space collision is Kessler Syndrome. Kubecka describes it: "A big enough collision would create a chain reaction, causing space junk to smash into each other all over orbit, forming a dust cloud." An accident or deliberate attack could trigger a Kessler Syndrome event. Kubecka explains, "It's now so cheap to build 'attack CubeSats' or even larger satellites. You could cause collisions." She also points to the growing use of Internet of Things (IoT) devices in space tech. "If IoT goes rogue, that's a big problem." As wealthy business people become more visible in space exploration, the potential for huge media attention will attract cybercriminals to attack their space systems and use them to create chaos in space – and so, chaos on Earth. Preventing a 'Kessler' event As well as protecting space systems from cyberattack through the best available methods, like cyber immunity – building systems in a way that makes them almost impossible to compromise – we must take out the space trash. As part of the Securing Space initiative, Kaspersky supports fledgling innovators StartRocket as they develop a new way to remove space debris from orbit – with foam.
Cybersecurity for home working in a hurry

Boost cybersecurity for remote working teams with system hardening

  • min read
    • COVID-19 has forced people around the world to work from home. For IT managers, in all industries and sizes of organization, there's more security risks to deal with. Why? Outside of the workplace, with on-premises tech teams on-hand when things go wrong, there's a whole host of threats that extenuate for employees working from home. Remote working heightens cyber-risks With no boss or co-workers looming over colleagues, there's more temptation to do personal things on a work device. Like shopping, letting your kids use your corporate laptop for homework, or succumbing to clickbait from untrusted websites. Right now, we're seeing a rise in phishing attacks related to COVID-19, falsely promising 'urgent health advice.' Outside the office, there's a higher risk your employees may unwittingly unleash a cyberattack. It could happen by doing something as simple as updating a free application like a PDF reader; many free downloads are riddled with vulnerabilities – opportunities for hackers to force access to your machine. If corporate devices aren't patched properly, it increases the chances those hackers will cause havoc. But now the majority of endpoint devices are remote and not on high speed corporate networks, patching is increasingly difficult. As the COVID-19 lockdown continues, updates will fall behind the release of new versions, making devices more vulnerable so it crucial to use endpoint solution layers to your advantage. If you haven't already, invest in training your homeworking employees to become more aware of cyber-risks. Aside from education, system hardening can help you minimize remote working attacks. What is system hardening? Imagine this: Your employee has a child who's been given a USB stick from their school with homework. The school doesn't have the best cybersecurity, and there's malware on it. Once that's on your colleague's work device, it can be compromised. But by disabling particular devices from accessing your USB ports, you eliminate that risk. This is an example of system hardening by tightening up access to your devices. So what else can you do? Like this story, it's simple: start with the basics. Layers are critical to your cybersecurity defenses First and foremost, if you don't have endpoint security protection – security solutions, like anti-malware that helps protect computers from cyberattacks – get it on all devices across your IT network. Many businesses buy endpoint protection just for blocking malware, but there are other layers within the software to protect your devices. Use all the security features, or layers, to your advantage. Firstly, use features which lets you limit or block specific applications you don't trust. Next, add a web control layer that blocks particular websites or their categories, which could include social media (unless that's part of your job), ecommerce or adult websites. The anti-malware layer should be your last defense against cyberattacks: Build the layers from the bottom up so hackers have more hurdles to jump before they get here. Harden first, invest in new tech next I work with IT managers in enterprises. About three in four of the people I speak to aren't using the full features of their endpoint product. The issues they're concerned about, like ransomware attacks, could be prevented with system hardening, yet there's a huge push to move onto next-gen technologies which defend by predicting, detecting and actively respond to cyber-threats. While these solutions are critical for the future of cybersecurity, before investing in more advanced tech, get the basics right first. If you don't, when you launch new solutions, you'll spend most of your IT team's time fixing smaller issues, like cleaning up malware, that could've been sorted through system hardening. Need next-level protection? If you have skilled IT security experts in your team, or you're handing sensitive customer data, you'll need more than just endpoint security. Consider upgrading to solutions like Kaspersky's EDR which offers response and forensic capabilities in the event of a cyberattack. It's simple: with system hardening, you're making each device as resilient to a cyberattack as it can be. With multiple layers of security in place, your IT team will have more time to focus on critical issues and keep the systems running smooth.
evolution of supply chain attacks

Detection is better than cure: Seeing and preventing supply chain attacks

  • min read
    • Supply chain attacks represent something of a sea change among hackers. They're not new, but they're fast becoming more common, and evolving to evade detection. These attacks involve implanting the part of a virus that executes an attack (the payload) into components like software, firmware and hardware. That payload becomes part of the finished product. Companies that sell these products become unwitting distributors. They stow away silently on customers' computers or networks until something triggers their malicious processes. Here, we focus on software supply chain attacks, but it's worth a few words on the other two to understand the scale and scope of supply chain vulnerabilities. Hardware supply chain attacks Supply chain attacks on hardware are often crude and cheap. For example, implanting keyloggers in USB drives, capable of registering 8,000 pages of keystrokes, or inserting a microphone into Ethernet networking connectors (RJ45 plugs), stealing passwords and other sensitive data. Firmware supply chain attacks Hackers also tamper with firmware by embedding malicious code that enters customer devices. Boot firmware is often the target. By using the booting process, it only takes starting the hardware to execute the malware. Software supply chain attacks Hackers like software supply chain attacks because they only need to compromise one link in a long chain to smuggle malware everywhere. They can insert malicious code into software at several points during build, compilation, distribution and update. The increasing sophistication of enterprise software also increases the number of attack options. Attacks can target the software's source code, embedding malicious code in the build of a trusted app. Sometimes the code is embedded in an executable file with an infected compiler (a program that translates code from one language to another) or linker (a program that combines the data the compiler generates into one executable file). Another frequent target is software update mechanisms. While genuine software developers often 'sign' their executables and scripts with a digital certificate to give their identity and confirm the code is unaltered, supply chain attacks often include stolen certificates that seem genuine. Software developers dependent on open source code, usually smaller operators, are particularly vulnerable to supply chain attacks. Significant supply chain attacks Attacks that make their own a hit list Some supply chain attacks have used highly sophisticated pre-attack planning to identify suitable targets. Energetic Bear was one of the most significant attacks on critical infrastructure. It used an opening spear-phishing campaign to make a hit list of suppliers to target. Ghost in the app-creating tool Even Apple, famous for its virus resistance, fell victim to a supply chain attack. Hackers used Xcode, a tool for creating iOS and OS X apps, to smuggle malicious code into apps. Apple hosted these apps unwitting in its App Store. While developers usually download Xcode safely from Apple, it's also available on developer forums. Hackers embedded malicious code in these alternative sources. Researchers from Alibaba called these malicious variants 'XcodeGhost.' They contained just a few extra lines of code – hard to detect, but enough to penetrate. Backdoor in popular server management software The ShadowPad incident is one of the largest known and most sophisticated supply chain attacks. In 2017, Kaspersky researchers discovered a 'backdoor' (dubbed ShadowPad) planted in server management software used by hundreds of large businesses around the world. When activated, the backdoor lets attackers download further malicious modules or steal data. In this case, hackers had signed the malicious code with a legitimate certificate. The pointer to the infected function was also hidden from the user's view. The attackers had gained access not only to the certificates but also to the source code and build environment. Researchers in Kaspersky's Global Research and Analysis Team (GReAT) immediately notified the suppliers, NetSarang, who quickly pulled down the compromised software and replaced it with an earlier clean version. NetSarang proved that responding fast to cyberattacks makes a difference. Kaspersky and NetSarang found only one infected payload – an excellent result given the product's popularity. Cleaner attack goes right to the top CCleaner is a hugely popular system cleaner, downloaded more than two billion times. After a supply chain attack in September 2017, infected software was downloaded two million times. Hackers attacked through a tiny backdoor. They encrypted all strings, making them harder to detect. Like the ShadowPad attack, hackers signed their malicious code with legitimate digital certificates. These hackers wanted to get right to the top. They included a function in determining if the user had admin privileges. The attack would only continue if the user had access to the company's Command and Control function. Because the attack was highly selective, the full infection was downloaded only onto 40 computers. But the CCleaner infection's victims included some of the biggest names in enterprise tech – Samsung, Fujitsu, Intel, Sony and Asus. This made it one of the most damaging and effective supply chain attacks discovered. Hammering through automatic update functions Kaspersky researchers discovered the Operation ShadowHammer attack in January 2019. We found a suspicious file signed with a legitimate digital certificate from Asus. While distributed from Asus's official server, the files contained a sneaky backdoor. Supply chain attacks often target automatic update functions. At first, hackers planted Operation ShadowHammer's malicious code in Asus's live updater tool, but the mode of attack evolved over time. Operation ShadowHammer targeted more than 400 computers, with multiple unique backdoored samples. Asus was not the only target. Since our first discovery, we've identified several other cases, including digitally signed examples, from three other software businesses. Hackers signed backdoors with different certificates and chains of trust in each attack. Detection is better than cure Detecting supply chain attacks is nuanced work. Sometimes attacks don't directly manipulate original code, with updates downloaded and executed only in computing memory. Games are among the most attractive supply chain attack targets. Here, it's harder to know whether malware is part of the software's original functionality. For example, anti-cheating and IP protection mechanisms can trigger behavior analysis logics. Malicious code in supply chain attacks is only a tiny portion of code in an executable file. It's like trying to find a polar bear in a snowstorm. This is made harder by the valid code-signing certificates that often accompany the malicious code. How can businesses defend against supply chain attacks? Suppliers are softer targets than finished product vendors, partly because the final package is more extensive and complex. So what can businesses do about it? 1.      Use the best cybersecurity software Lightweight security solutions prioritize speed over rigor, leaving the risk of being fooled by supposedly legitimate code-signing certificates or mistaking suspicious files for false positives. Dedicated cybersecurity solutions do it better. A proven, corporate-grade security solution is essential for spotting and catching advanced targeted attacks. These analyze anomalies and give cybersecurity teams full visibility over their network, with an automated response. 2.      Hire the right team, and the red team Businesses should hire highly skilled information security personnel, including security specialists, SOC (security operation center) analysts and 'red teams.' 3.      Use threat modeling during software development During software development, companies must create a threat model for their development infrastructure to identify and eliminate risks in advance. Access models should apply the Principle of Least Privilege (PoLP) to restrict the risk of malicious access. 4.      Carefully manage supplier relationships Build trust that goes beyond traditional assumptions. 5.      Invest in response As we saw with NetSarang's rapid response to the ShadowPad attack, businesses must invest in response as well as protection. If you don't have internal capacity, involve an incident response team to investigate an incident or suspicious activity. Article published in 2019.
inhouse vs outsource SOC balls boat

What to consider before launching a security operations center

  • min read
    • You have some big decisions to make if you're thinking about launching a security operations center (SOC). Some you can easily scope out in advance, but others need further thought. Let me take you through the process and highlight the potential outcomes. How does a security operations center differ from a network operations center? First, you should understand the difference between a SOC and a traditional NOC (network operations center.) NOCs are mostly concerned with keeping the packets flowing through the digital pipes and finding and removing blockages. SOCs extend this basic "plumbing" and ensure that the right packets end up in the right places, and look for inappropriate situations. For example, A NOC would be concerned about abnormal network latency reports, while a SOC might see a rogue endpoint obtain elevated access rights and use lots of network resources that could be causing poor latency. A SOC and a NOC may display a different response to seeing a false positive: Within a NOC, it isn't usually triggered as an issue as its purpose is to send alerts about whether the network is working or not. With a SOC, it could show your infrastructure has been penetrated. Decide whether to build or outsource your SOC The biggest decision in launching a SOC is to decide whether to buy or outsource. Both scenarios have lots of complexities in the decision process and eventual outcome. To build, you can create a physical SOC that sits inside your facilities. For buying, you can use a SOC-as-a-service (SOCaaS) vendor. Sitting in between these two positions is the option to use a managed security solution provider (MSSP). Some MSSPs provide equipment for you to install on-site, others manage everything from their SOC using cloud services. This middle ground could be a good starting place to evaluate your experience before transitioning entirely into a SOCaaS. This can be a good option as you may not understand the entirety of what you have to outsource. Having an MSSP can give you a "SOC-lite" with some managed services and some feedback on security issues without having to completely outsource everything from the start. If you don't yet know the right questions to ask, the MSSP route can give you more context. The origins of SoCaaS vendors Part of the reason for the complex picture: SOCaaS isn't defined consistently from vendor to vendor. It's partly because of the different origins of these vendors: some started as MSSPs, others as specialized managed detection and response vendors, or event or endpoint management providers. Some SOC vendors began life as the services group and subsidiary for a major computing firm or telecoms company selling managed NOCs (e.g HP, IBM and Dell) before moving into the SOC world. In other cases, cybersecurity consultants and solutions providers are developing SOC-like services and frameworks. These origin stories matter because they create an expectation as to the strengths and proprietary technologies that each vendor uses, and also for you to characterize them when you start shopping around. And shop you must – it's a highly fragmented market. Gartner reports that the top MSSPs are IBM, AT&T/AlienVault, Atos, Dell Secureworks and DXC Technology – yet none of them have greater than five percent market share. How to evaluate SOC-aaS vendors The first question you need to define is also the hardest – what are your requirements? From this you can work out your budget and what you will need to purchase first. It's hard, partly because the cloud-based providers always have complex usage-based cost calculations (think pricing an AWS server.) And many of them don't provide any details on their pricing before you engage them for services, or at least sign a non-disclosure agreement. Some of the smaller vendors have fixed monthly fee contracts based on the number of services you consume. When I reviewed a collection of providers, estimates were all over the place, differing by several orders of magnitude. Vendors should be more transparent on costs up front. If you are considering building your own SOC, first compare what the outsourcers will charge, then see if you can make a business case for using that investment to host your SOC in house. Part of the pricing problem: you might not know how many servers or endpoints (or whatever you're protecting) you will initially need with your SOC vendor. You could start small, with a proof-of-concept, and see how the vendor produces reports and interacts with your staff on problems or traffic issues. Planning what services you need Once you get beyond the fee calculation, your next issue is understanding your resources, including the people and tools they need to do their jobs to manage your security and the SOC itself. You might not have the skilled staff to handle incident response, threat hunting and operations management. This might tip the scales towards having a SOCaaS rather than building your own. You'll also want to understand what kind of coverage you'll need. If you operate a global online business, you'll need 24/7 monitoring, and you'll also have to have your staff available at all hours too. You might want a vendor that has multiple physical SOCs on different continents so you can ensure there will be someone somewhere in the world who will be watching your networks from different parts of the world. This multi-zone approach can also expose difficulties that may be faced with latency or accessing your website. Part of your resource evaluation is also in understanding who is staffing the outsourced SOC? What kind of training is required to work there? How many people are on duty on the overnight shifts? Do you have a lead analyst at your provider that you can contact in case of an emergency? Is the vendor's staff managing alerts or are they doing the actual nuts-and-bolts security analysis and providing recommendations on your response and remediation? You'll also want to consider what you're trying to accomplish: Do you want timely breach notifications? Are you deciding to forgo any full-time staff hires or trying to save on new capital equipment? Then comes geography. Where is your equipment, staff, and the actual SOC physically located? If your offices are mainly in a metropolitan area, you may want a SOCaaS vendor who has a secondary office located elsewhere in case of a major disaster (like earthquakes, hurricanes or a tsunami) that could take down your local area's connectivity. Finally, you'll want to define the various component services for your SOC, such as security event management or threat monitoring and detection. Log analysis, vulnerability management and incident response are all necessary and you'll need them eventually, so plan accordingly to be able to scale. Look out for these warning signs It's a good idea to do a proof-of-concept before a full rollout of your SOC. Before you choose your vendor, be alert to these warning signs from a study about improving the effectiveness of SOCs. No similar customers The vendor isn't aligned with your business or doesn't have other customers of similar size, market penetration or type of business. Incompatibility Your legacy event management and service desk systems are compatible with what your SOC vendor provides, and you have to switch to some other system. No visibility You don't have visibility or control over your essential network functions and conditions. Staff frustrations You have high turnover with your security staff and low job satisfaction and high-stress levels. False positives Your SOC is chasing too many false positives and not closing these cases. How to get started With increasing volume and severity of threats on the doorstep of companies of all sizes, now is the time to start planning if your current NOC is going to be enough or if it's time to upgrade to a SOC. According to Artem Karasev from Kaspersky: Good luck with establishing your SOC!
cybersecurity purchasing strategy

Avoid costly firefighting: how to be smarter about cybersecurity procurement

  • min read
    • Impulse buying IT solutions feels like you've achieved something today, but have you just given yourself an integration headache for tomorrow? With a more planned approach, you can get more from your budget and protect your resources more effectively. Here are two questions to ask yourself: For most organizations, their approach is to try to understand the vendor landscape and then understand the breadth and complexity of their IT security problems. To an extent, this strategy can work. If you buy the best products you can find according to the budget you have, then you're working towards having the optimal security posture for your organization. But the vendor landscape today is so concentrated that you can spend all of your time just trying to understand all of the products you could use, then choosing between them. Keeping an eye on Sounil Yu's Cyber Defense Matrix helps you deal with this. As you read this, I expect your risk register is top of mind, right alongside the most recent data breach you've just heard about. So it can feel right to get on and do something rather than stop, think and consider alternative courses of action. By taking action, for example, buying a product, you think the problem's fixed, giving you one less thing to think about. The problem?  This 'strategy' doesn't work. But why? Firstly, it doesn't support an organizational policy. It's just what you did before, and so it's what you continue to do. Easy win. This approach prevails without proper reflection, and no one can question the decision because it's never clearly expressed in a way that permits it to be challenged. Secondly, your company ends up with a mix of disconnected solutions that are installed but not configured, and sometimes their monitoring capabilities and logs, which looked so impressive during the sales presentation, and only considered after a suspected breach. However, with some small changes, the buying approach can pay off, or at least reduce the effort you spend firefighting down to a manageable level, so you have breathing space to focus on new projects. Here are three ways you can get smarter about buying the right cybersecurity solutions for your business. 1. Have a buying strategy for attending events Firstly, use the conferences and exhibitions you attend intelligently. InfoSec conferences, especially those dominated by a vendor hall rather than by tracks of presentations, can be beneficial if used in the right direction. It can be tempting to use the occasion to catch up with contacts in the industry, put in an order for a new solution to justify the time and money it took to attend and then go home. But you can be smarter than that. Don't be afraid to play off vendors against each other. Shuttle between them comparing advantages, answers and prices, examining any criticisms raised by one vendor with the responses of another. Ask someone who has left a booth you've been at, or are considering visiting, what they thought of a solution and its vendor, and if there are any aspects they found particularly useful or troubling. It's a good way to think through your current position, with a side benefit to make the most of networking opportunities without the shallow performance of pushing your business card (or scanning your pass at more technologically advanced events.) 2. Try before you buy Secondly, consider either a bake-off or a trial period or a pilot project – whichever is your organization's preferred way of working. A bake-off is similar to the televised cooking competitions; each of the products under consideration is put in direct competition with the others to see which offers you the best solution for the least code. The options you select, of course, depend on the structure of your estate and many other factors about your organization, but in a rush to resolve an issue, you can instead spend a few weeks testing your implementation, and so saving yourself time in the long run. In particular, either a bake-off or a pilot project shows that the products are under serious consideration, and your vendors should be able to devote resources to making the test period a success and resolve any technical issues before a full rollout. I recommend sequential pilot projects over bake-offs, only progressing to the next pilot project if the previous one didn't give you the results you wanted. A pilot project is far less intensive than the effort required for a bake-off and dealing with multiple vendors simultaneously. Also, it's much easier to have set aims for a pilot project, making it an easy purchasing decision at the end of the trial period, while keeping everyone focussed during the exercise. 3. Take a lesson from the world of gaming Finally, consider "table-topping" or "wargaming" the introduction of the technical solution. This is like running a pilot project, but conceptually. By "wargame," I mean a business wargame. It's called a "tabletop" because that's where you run the game, and that's specifically where everyone concentrates their attention. You can either buy an appropriate game, hire a consultant to build one, or design one yourself. The process is more straightforward than you think. To put a simple wargame together, you need some kind of board to represent the situation you're discussing (for example, a network diagram), some pieces or markers to represent different resources (like some coins to represent the available budget) and a brief set of rules to determine how the game progresses. This prevents decisions being made according to the opinion of the most senior person present. Unfortunately, the word "game" has all kinds of unhelpful connotations, making the exercise not seem serious enough for the gravity of the decision you're making, but the game and its rules are there to help you think and to encourage everyone to contribute. Meetings are a poor format for decision-making, with the quality of the decision usually determined by how long the meeting was, who shouted the loudest and how close it was to lunch. By running a tabletop exercise playing through the implementation of a project, you can get everyone around the table to consider the impact of the new technology in their field. Does a more efficient endpoint threat management solution send too many alerts to the over-worked Security Operations Center? Does the new firewall implementation work with existing configuration maintenance software?  From there, scenario plan a typical day or week and judge the impact on your staff and those departments who you work with on taking on the new solution. Don't be afraid to modify the format of the game as it progresses, to use counters or markers on a board to represent the impact of network changes or the demands on staff. A simplistic representation of your proposed solution can quickly reveal unrealistic demands or requirements that never come out in discussions or a spreadsheet-based analysis. As a side benefit, getting people together to think through a procurement decision and its ramifications in this structured way can have serendipitous benefits, as different silos within your organization form stronger links, improving decision making in the future. Overall, buying the best solutions you come across can get you through the next quarter, especially if you combine it with the occasional heroic effort by your employees when inevitable problems occur. But that kind of strategy isn't sustainable, and it isn't the optimum use of your resources. Your attackers are becoming smarter, but your budgets aren't getting bigger, so you're going to have to out-think your opponents. By planning more strategically before buying, you can make the most of your IT security budget. The opinions in this article represent those of the author.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries